XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk


(1) 2 »


1
drbowen
Re: Permission Problems with Wiwimod

  • 2008/4/24 20:49

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


I looks like I solved this. Somewhere the visible attribute in the wiwimod got switched to "0" on most of the pages. Switching the visibility back to "1" brought everything up.

Sam Bowen
http://www.oemr.org/
Topic | Forum


2
drbowen
Permission Problems with Wiwimod

  • 2008/4/23 19:07

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


I have developed a popular web site using XOOPS 2.2.3a. I have the following system and modules:

System:
FreeBSD 6.2
Apache 2.2
PHP 5.2.3 with Suhosin-Patch 0.9.6.2
MySQL 5.2.

Installed modules:
System
Private Messaging
Extended Profiles
Wiwimod
C-Jay Content
News
CBB

I have a permission problem on the Wiwimod where I would like to make all content viewable but new content can only be added by a special group "WikiUsers".

I was having trouble with registered users adding content that was inappropriate and off topic.

I have added permissions for "anonymous" to read the Wiwimod.
I have given read and write permissions to "WikiUsers".
I have added about 5 people to the "WikiUsers" group.

Everything seemed to working fine. Now none of the users can access the content and get a message:

"Sorry, restricted access page."

I have tried reassigning privileges on the groups. I have tried reassigning privileges on the Wiwimod.

Any ideas or help would be appreciated.

Sam Bowen

http://www.oemr.org/
Topic | Forum


3
drbowen
Re: XOOPS security

  • 2007/10/27 16:49

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


No I do not. I ended up not installing any of the WSIWYG editors.

When I first installed XOOPS 2.2.3 it was the recommended stable most recent version. It became apparent that a lot of the modules were not compatible with 2.2.3, I remember trying to install one of the WYSIWYG editors but it didn't work (I don't remember ever trying Spaw).

Later the XOOPS developer group decided to back up and go back to 1.3.10 as the recommended stable release. This has now progressed to 2.0.17.1.

I have been stuck. Reverting 2.2.3a back to 1.3.10 is not very easy. The XOOPS roadmap states that eventually the two branches will be brought back together in 2.4. But I am not sure if and when this will actually occur.

Sam Bowen, MD
www.oemr.org
Topic | Forum


4
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/27 15:59

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


If you change to the public_html directory and type

ls

does it list the index.php?

You might try modifying the script to add a ./ in front of the index.php.

<head><title>Royal Welsh Veterans</title><script type="text/javascript">window.location="./index.PHP";</script></head>

Sam Bowen, MD
www.oemr.org
Topic | Forum


5
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/26 21:21

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


Kevin,

I can see the content of your index.html.

Why don't you replace the contents of index.html with the following:

<head><title>Royal Welsh Veterans</title><script type="text/javascript">window.location="index.PHP";</script></head>

Save and reload.

Sam Bowen, MD
www.oemr.org
another XOOPS site
Topic | Forum


6
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/26 20:29

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


Dear Kevcar,

I was Googling around and found this reference that may have relevance to your situation. Check it out.

http://www.linuxtopia.org/online_books/redhat_selinux_guide/rhlcommon-section-0055.html

On Redhat Enterprise Linux the relevant error messages may relate to the SELinux which imposes a lot of extra restrictions on permissions and access of files. The relevant error messages appear to reside in:

/var/log/messages

What are the names of the directories, in order, from the file root:

/

For instance on my server the web server root is:

/usr/local/www/data/xoops/

This should be listed in the the mainfile.php To answer the question you asked above, open a command line interface, Su (change user) to root. From the root prompt (looks like a # sign). Type the following:

ls -al public_html

This needs to be executed from the directory where public_html is located.

Sam Bowen, MD
www.oemr.org
Topic | Forum


7
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/26 18:32

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


I need to know what operating system you are running.

Do you know the path to your web server root (where the XOOPS directory is located)?
Topic | Forum


8
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/26 15:28

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


You need to list the permissions on your web server root:

# ls -al /pathtoyoursite/xoops/
Topic | Forum


9
drbowen
Re: HTTP 403 (Forbidden) Can't log on to my site

  • 2007/10/26 14:04

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


We could use some more information such as do you own your own server or are you using a colocation site?

Version of XOOPS?

Do you have any security files installed such as

.htaccess

index.html

Have you changed anything on the site or the server configuration?

Is there any information in the web server error logs?

On Linux/Unix using apache this is usually in:

/var/log/apache/error_log

but varies with your operating system. Windows would have this in the system event log.

Sam Bowen
Topic | Forum


10
drbowen
Re: XOOPS security

  • 2007/10/26 13:41

  • drbowen

  • Just popping in

  • Posts: 19

  • Since: 2006/4/28


Yes, oemr.org.

I appreciate the input a lot.

I have been examining the files with (hopefully) wiser eyes. The malicious files are owned by the apache web server and have the same owner and group permission as my Apache web server process.

To me this implicates a registered user who is posting this somehow using the XOOPS software, possibly using the newbb or the wiwimod to load the malicious software.

I need to start logging which users are posting if possible. This is likely someone very familiar with the behavior of XOOPS to be able to insert the files in the cache/, templates_c/, and updates/ directories using XOOPS and the Apache webserver.

I am running XOOPS 2.2.3a. I have the following modules installed:

System
Private Messaging
Extended Profiles
Wiwimod
C-Jay Content
News
CBB

The files were in

uploads/ Chase Bank scam

cache/ Paypal scam

These were javascripts that redirect users to previously hacked web servers. The user had inserted malicious files into into poorly secured web servers (inappropriate file ownership permissions). The Chase Bank scam has already been closed by the owner of the hacked web page. I have contacted the administrator of the site that contains the PayPal scam and asked them to remove the malicious files.

I would like to identify the user and prosecute them if possible.

Any thoughts?

Sam Bowen
Topic | Forum



TopTop
(1) 2 »



[Advanced Search]

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Who's Online

134 user(s) are online (100 user(s) are browsing Support Forums)

Members: 0

Guests: 134

more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Apr 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits